SC-900 Practice Test 47 — 15 Questions

Question 1

Refer to the exhibit. The Conditional Access policy is configured to block access for high-risk users. A user with a medium risk level attempts to sign in. What will happen?

Accepted Answer

Access is granted. The Conditional Access policy is configured to block access for high-risk users only. Since the user has a medium risk level, the policy condition is not met, so the policy does not apply. Therefore, access is granted based on the default behavior of allowing sign-in when no Conditional Access policy is triggered.

Answer

Access is blocked

Answer

User is redirected to a password reset page

Answer

User is prompted for MFA

Question 2

Your organization uses Microsoft Defender for Cloud to secure Azure resources. You need to ensure that all storage accounts have soft delete enabled to protect against accidental deletion. Which policy should you implement?

Accepted Answer

Azure Policy with a built-in policy for storage accounts. Azure Policy with a built-in policy for storage accounts is correct because it allows you to enforce organizational standards and assess compliance at scale. The built-in policy 'Storage accounts should have soft delete enabled' can be assigned to a subscription or resource group to automatically audit or remediate storage accounts that do not have soft delete configured, ensuring protection against accidental deletion.

Answer

Azure Blueprints

Answer

Azure role-based access control (RBAC)

Answer

Defender for Cloud security recommendations

Question 3

A user is locked out of their account after multiple failed sign-in attempts. You need to reduce false lockouts while maintaining security. What should you do?

Accepted Answer

Enable Smart Lockout. Microsoft Entra Smart Lockout is designed to protect against brute-force attacks while reducing false lockouts for legitimate users. It uses a combination of familiar location and unfamiliar location thresholds to differentiate between malicious attempts and valid users who may have mistyped their password. Enabling Smart Lockout allows you to set a higher threshold for familiar locations and a lower threshold for unfamiliar locations, thus maintaining security without locking out legitimate users. The other options either do not address false lockouts (MFA) or weaken security (disabling lockout, increasing threshold globally).

Answer

Require MFA for all users

Answer

Disable account lockout

Answer

Increase lockout threshold to 20 attempts

Question 4

Which TWO Microsoft Purview solutions can help identify and protect sensitive data in Microsoft Teams? (Choose TWO.)

Accepted Answer

Information Protection. Information Protection (B) is correct because it uses sensitivity labels and the Microsoft Purview Information Protection client/service to classify and protect content, and these labels can be applied to Teams messages and files so sensitive data is identified and protected. Data Loss Prevention (D) is correct because DLP policies in Microsoft Purview can detect sensitive information types in Teams chat and channel messages and take protective actions such as blocking or warning users. Communication Compliance (A) focuses on detecting policy violations in communications for review, not on classifying/protecting sensitive data. Data Lifecycle Management (C) governs retention and deletion of content rather than identifying/protecting sensitive data. Insider Risk Management (E) detects risky user behavior and generates alerts/cases, but it is not the primary solution for identifying and protecting sensitive data in Teams.

Answer

Communication Compliance

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Question 5

Which TWO of the following are capabilities of Microsoft Purview Communication Compliance? (Select TWO.)

Accepted Answer

Enforce company policies on communication channels. Option A is correct because Communication Compliance is designed to help organizations enforce their internal policies and codes of conduct across communication channels such as Microsoft Teams, Exchange Online, and Viva Engage by detecting policy violations. Option B is correct because Communication Compliance uses built-in and custom classifiers to detect offensive, harassing, or inappropriate language in emails and Teams messages, including profanity, threats, and targeted harassment. Option C is not correct because automatic sensitivity label application is a capability of Microsoft Purview Information Protection (auto-labeling policies), not Communication Compliance. Option D is not correct because preventing the sharing of credit card numbers via email is handled by Data Loss Prevention (DLP) policies in Microsoft Purview, not Communication Compliance. Option E is not correct because placing legal holds on user mailboxes is a capability of Microsoft Purview eDiscovery (or Exchange litigation hold), not Communication Compliance.

Answer

Automatically apply sensitivity labels to documents

Answer

Prevent sharing of credit card numbers via email

Answer

Place legal holds on user mailboxes

Question 6

Which THREE of the following are features of Microsoft Purview Compliance Manager? (Select THREE.)

Accepted Answer

Compliance score and templates for custom assessments. Option B is correct because Compliance Manager provides a compliance score that quantifies an organization's posture and supports custom assessment templates so you can build assessments for your own controls and standards. Option C is correct because Compliance Manager ships with pre-built assessments mapped to common regulations and standards such as GDPR, ISO 27001, and NIST, letting you evaluate against them out of the box. Option E is correct because Compliance Manager includes Microsoft-managed improvement actions that guide remediation steps for regulations, and Microsoft updates these actions as regulations and Microsoft services change. Option A is not a Compliance Manager feature; record declaration and disposition reviews are handled through records management in Microsoft Purview (e.g., retention labels and disposition review). Option D is not a Compliance Manager feature; trainable classifiers are a Microsoft Purview data classification capability used to identify sensitive content, not to assess regulatory compliance.

Answer

Record declaration and disposition reviews

Answer

Trainable classifiers to identify sensitive content

Question 7

Which TWO of the following are types of retention actions available in Microsoft Purview? (Choose two.)

Accepted Answer

Retain data for a specified period. Option A (Retain data for a specified period) is correct because Microsoft Purview retention policies and retention labels support a retain action that keeps content for a defined duration, such as 7 years, before any further action occurs. Option D (Delete data after a specified period) is correct because Purview retention settings also provide a delete action that removes content once the specified retention period expires, either alone or combined with retention. These two actions—retain and delete—are the fundamental retention actions configurable in Purview retention policies and labels. Option B is incorrect because encryption at rest is handled by services such as BitLocker, Azure Storage Service Encryption, or Microsoft 365 encryption features, not by retention actions. Option C is incorrect because classifying data as confidential is a sensitivity labeling or classification function, not a retention action. Option E is incorrect because searching for data using eDiscovery is an investigation and discovery capability, not a retention action.

Answer

Encrypt data at rest

Answer

Classify data as confidential

Answer

Search for data using eDiscovery

Question 8

A healthcare organization must demonstrate compliance with HIPAA by assessing their current posture against regulatory controls, tracking improvement actions, and generating reports for auditors. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the correct solution because it provides a built-in assessment template for HIPAA, enabling the organization to assess its current compliance posture against regulatory controls, track improvement actions, and generate auditor-ready reports. It offers a compliance score, automated control mapping, and evidence collection workflows specifically designed for regulatory frameworks like HIPAA.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Insider Risk Management

Question 9

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their existing Facebook accounts without creating a separate Microsoft Entra ID account. What should you configure?

Accepted Answer

Create a Microsoft Entra External ID tenant and add Facebook as an identity provider. Microsoft Entra External ID (formerly Azure AD B2C) is designed to allow external identities, such as social identity providers like Facebook, to authenticate users without requiring a separate Microsoft Entra ID account. By creating an External ID tenant and adding Facebook as an identity provider, you enable users to sign in using their existing Facebook credentials via OAuth 2.0 or OpenID Connect protocols.

Answer

Configure Microsoft Entra ID Protection

Answer

Enable Microsoft Entra ID Domain Services

Answer

Configure Microsoft Entra ID Governance

Question 10

A company uses Microsoft Entra ID. The IT department wants to automatically assign a Microsoft 365 E5 license to all users in the Sales department based on their department attribute. Which Microsoft Entra ID feature should they use?

Accepted Answer

Dynamic Groups. Dynamic Groups in Microsoft Entra ID allow automatic user membership based on user attributes, such as the department attribute. By creating a dynamic group rule like `user.department -eq "Sales"`, the system automatically assigns the group membership and can then apply a Microsoft 365 E5 license via group-based licensing.

Answer

Administrative Units

Answer

Identity Protection

Answer

Access Reviews

Question 11

A company wants to prevent users from using common passwords like 'Password123' and custom banned passwords such as 'Contoso2024' during sign-up or password change. They also need to apply a common list of banned passwords across tenant-wide. Which Microsoft Entra feature should they configure?

Accepted Answer

Microsoft Entra ID Password Protection. Microsoft Entra ID Password Protection allows administrators to enforce both a global banned password list (Microsoft-managed) and a custom banned password list (tenant-specific). This feature blocks weak passwords like 'Password123' and custom entries like 'Contoso2024' during sign-up or password change operations, making it the correct choice for tenant-wide password policy enforcement.

Answer

Conditional Access

Answer

Identity Protection

Answer

Multifactor Authentication (MFA)

Question 12

A company wants to allow users to reset their own passwords from the login screen without contacting IT. Which Microsoft Entra ID feature enables this?

Accepted Answer

Self-Service Password Reset. Self-Service Password Reset (SSPR) is the Microsoft Entra ID feature that allows users to reset their own passwords from the login screen without contacting IT. It is specifically designed to reduce helpdesk workload by enabling password changes or unlocks through a verified authentication method, such as a phone call, text message, or the Microsoft Authenticator app.

Answer

Conditional Access

Answer

Multifactor authentication

Answer

Identity Protection

Question 13

Refer to the exhibit. An administrator runs the PowerShell cmdlet shown. What is the purpose of this command?

Accepted Answer

To display the display name and user principal name of members of the Sales group.. The PowerShell cmdlet `Get-AzureADGroupMember -ObjectId <SalesGroupObjectId>` retrieves the members of a specific Microsoft Entra ID group. By default, it returns the members' display names and user principal names (UPNs), which are the primary identifiers for users in Microsoft Entra ID. Option D correctly identifies this purpose.

Answer

To show the dynamic membership rules of the Sales group.

Answer

To list all groups in the Sales department.

Answer

To list Azure AD roles assigned to the Sales group.

Question 14

Refer to the exhibit. You are reviewing a sensitivity label configuration in Microsoft Purview. Based on the exhibit, what is the result when a user applies this label to a document?

Accepted Answer

The document is encrypted and a header/footer is added. The exhibit shows a sensitivity label configured with both encryption (via Azure Information Protection) and content marking (header/footer). When a user applies this label, the document is automatically encrypted to protect sensitive data, and the specified header and footer are added to the document as visual markings. This is a common configuration in Microsoft Purview Information Protection to enforce protection and awareness simultaneously.

Answer

The label is automatically removed after one year

Answer

The document is automatically deleted after 30 days

Answer

The document can be printed but not edited

Question 15

Your organization uses Microsoft Sentinel. You need to create a custom analytics rule that triggers an incident when a user fails to sign in more than five times within an hour. Which rule type should you use?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a KQL query that counts sign-in failures per user over a specified time window (e.g., 1 hour) and triggers an incident when the count exceeds a threshold (e.g., 5). This rule type runs on a schedule you define, making it ideal for detecting patterns like brute-force attempts that require aggregation over time.

Answer

Fusion rule

Answer

Near-real-time (NRT) analytics rule

Answer

Machine learning (ML) behavioral analytics rule